domain.homograph.test.ts

1// LV-2: homograph detector tests.2import { describe, expect, it } from "vitest";3import { detectHomograph, getSecurityOriginDisplay } from "./domain";45describe("detectHomograph", () => {6  it("flags a hostname with non-ASCII (Cyrillic homograph) characters", () => {7    // "аpple.com" — leading а is Cyrillic U+0430, not Latin a.8    expect(detectHomograph("https://аpple.com")).toBe(true);9  });1011  it("flags a punycode (xn--) label", () => {12    expect(detectHomograph("https://xn--pple-43d.com")).toBe(true);13  });1415  it("accepts a bare hostname without a scheme", () => {16    expect(detectHomograph("xn--pple-43d.com")).toBe(true);17  });1819  it("returns false for a plain ASCII domain", () => {20    expect(detectHomograph("https://apple.com")).toBe(false);21  });2223  it("returns false for malformed input", () => {24    expect(detectHomograph("")).toBe(false);25    expect(detectHomograph("http://")).toBe(false);26  });27});2829describe("getSecurityOriginDisplay", () => {30  it("PB-26-707/PB-26-710 preserves scheme, full hostname, and non-default port", () => {31    expect(getSecurityOriginDisplay("https://login.accounts.example.com:8443/sign-in?next=/vault"))32      .toBe("https://login.accounts.example.com:8443");33  });3435  it("keeps invalid input visible instead of inventing a trusted origin", () => {36    expect(getSecurityOriginDisplay("not a URL")).toBe("not a URL");37  });38});